Backside security shield

ABSTRACT

A physically unclonable function circuit (PUF) is used to generate a fingerprint value based on the uniqueness of the physical characteristics (e.g., resistance, capacitance, connectivity, etc.) of a tamper prevention (i.e., shielding) structure that includes through-silicon vias and metallization on the backside of the integrated circuit. The physical characteristics depend on random physical factors introduced during manufacturing. This causes the chip-to-chip variations in these physical characteristics to be unpredictable and uncontrollable which makes more difficult to duplicate, clone, or modify the structure without changing the fingerprint value. By including the through-silicon vias and metallization on the backside of the integrated circuit as part of the PUF, the backside of the chip can be protected from modifications that can be used to help learn the secure cryptographic keys and/or circumvent the secure cryptographic (or other) circuitry.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is an illustration of a security shielded integrated circuit diewith through-silicon vias.

FIG. 2A is an illustration of an integrated circuit having securitystructures and circuitry.

FIG. 2B is an illustration of the integrated circuit where a backsidesecurity structure has been modified by removing material.

FIG. 2C is an illustration of the integrated circuit where a backsidesecurity structure has been modified by adding material.

FIG. 2D is an illustration of the integrated circuit where a front sidesecurity structure has been modified by adding material.

FIG. 3 is a flowchart illustrating a method of detecting modificationsto a backside metal layer.

FIG. 4 is an illustration of a computer system.

DETAILED DESCRIPTION OF THE EMBODIMENTS

Many electronic devices (e.g., cell phones, tablets, set-top boxes,etc.) use integrated circuits that have secure cryptographic keys andsecure cryptographic circuitry. These keys and circuitry may be used,for example, to secure data on the device, to secure communication,and/or to authenticate the device. It is desirable to protect the keysand/or other information used by the device from disclosure (therebyprotecting the data on the device, preventing unauthorized use, etc.)

When an attacker has physical access to the integrated circuit (e.g., bypurchasing a device), attacks designed to learn the secure cryptographickeys and/or circumvent the secure cryptographic circuitry can be carriedout by modifying the chip in some manner. A chip may be modified for thepurposed of these attacks using, for example, a focused ion beam (FIB)workstation. A FIB machine can cut tracks in a chip's metallizationlayer, deposit new metal tracks, deposit new isolation layers, removematerial (e.g., bulk silicon) to facilitate probing of circuits andsignals, implant ions to change the doping of an area of silicon, andbuild conductors to structures in the lower layers of the chip. One ormore of these types of modifications can be used to help learn thesecure cryptographic keys and/or circumvent the secure circuitry.

In an embodiment, a physically unclonable function circuit (PUF) is usedto generate a fingerprint value based on the uniqueness of the physicalcharacteristics (e.g., resistance, capacitance, connectivity, etc.) of atamper prevention (i.e., shielding) structure that includesthrough-silicon vias and metallization on the backside of the integratedcircuit. The physical characteristics depend on random physical factorsintroduced during manufacturing. This causes the chip-to-chip variationsin these physical characteristics to be unpredictable and uncontrollablewhich makes it virtually impossible to duplicate, clone, or modify thestructure without changing the fingerprint value. Thus, by including thethrough-silicon vias and metallization on the backside of the integratedcircuit as part of the PUF, the backside of the chip can be protectedfrom modifications and/or observations that can be used to help learnthe secure cryptographic keys and/or circumvent the secure circuitry.

FIG. 1 is an illustration of a security shielded integrated circuit diewith through-silicon vias. In FIG. 1, integrated circuit die 100includes physically unclonable function circuitry (PUF) 120, substrate131, passivation layer 140, passivation layer 141, backside metal layerstructure 171, backside metal layer structure 172, backside metal layerstructure 173, front side metal layer structure 151, front side metallayer structure 152, front side metal layer structure 153, front sidemetal layer structure 154, through-silicon via (TSV) 161, and TSV 162.PUF circuitry 120 is illustrated as being integrated with substrate 131.

TSV 161 is illustrated as being connected to PUF circuitry 120 via frontside metal layer structure 151. TSV 162 is illustrated as beingconnected to circuitry PUF 120 via front side metal layer structure 152.Passivation layer 140 and passivation layer 141 are illustrated on theside of integrated circuit die 100 that includes PUF circuitry 120(a.k.a. the ‘front’ or ‘top’ side of integrated circuit die 100.)Backside metal layer structure 171, backside metal layer structure 172,and backside metal layer structure 173 are illustrated on the side ofintegrated circuit die 100 that does not include active circuitry(a.k.a. the ‘back’ or ‘bottom’ side of integrated circuit die 100.)

In an embodiment, one or more of TSV's 161-162 are used to establishconnectivity between PUF circuitry 120 and one or more of backside metallayer structures 171-173. The one or more of backside metal layerstructures 171-173 that are connected to PUF 120 are thereby integratedas part of active PUF circuitry 120. In this way, a modification to theone or more of backside metal layer structures 171-173 that areconnected to PUF 120 (e.g., during a FIB attack that targets circuitryvia the backside of a chip) would change the PUF value. If the PUF valueis used, for example, to scramble or encrypt data stored on the chip(e.g., data stored in an on-chip non-volatile memory), the changing ofthe PUF value destroys the usability the data stored on the chip.

PUF 120 may rely on different naturally-mismatched physical propertiesof integrated circuits to produce its outputs. Backside metal layerstructures 171-173 can be connected to PUF 120 so that thenaturally-mismatched physical properties of backside metal layerstructures 171-173 affect the value(s) output by PUF 120. For example,PUF 120 may rely (at least in part) on the slight mismatch ofresistances formed by two or more backside metal layer structures171-173. These small variations in resistance across or between backsidemetal layer structures 171-173 are used by PUF 120 to determine anoutput value.

It should be understood that by using backside metal layer structures171-173 (when appropriately designed and laid out), PUF 120 is moreresistant to several types of attacks. These include, but are notlimited to photonic emission attacks and FIB attacks. Photonic emissionattacks are resisted because the backside metal layer structures 171-173absorb the near-infrared signals that are typically collected duringthis type of attack. Thus, removing all or part of a backside metallayer structure 171-173 so that the emissions of a sensitive activecircuit on the front side can be observed causes PUF 120's output valueto change. This change in the value that PUF 120 outputs can be used todetect the tampering and/or render protected data on integrated circuit100 unusable/unrecoverable.

Likewise, a FIB attack that modifies a backside metal layer structure171-173, causes PUF 120's output value to change. If, for example, ahash of the PUF 120 output value is used by integrated circuit 100 todecrypt a secure region of an on-chip non-volatile memory, then a changeof a single bit or more of the PUF 120 output value renders the contentsof a non-volatile unrecoverable.

In an embodiment, PUF 120 is configured to apply a first electricalstimulus to one or more of backside metal layer structures 171-173. Thiselectrical stimulus is applied through TSV 161. For example, PUF 120 maybe configured to apply a supply or other known voltage to one or more ofbackside metal layer structures 171-173 using TSV 161. PUF 120 is alsoconfigured to receive a response by the one or more of backside metallayer structures 171-173 to the first electrical stimulus that is basedat least in part on an electrical characteristic of backside metal layerstructures 171-173. This response is received using TSV 162. Forexample, the response backside metal layer structures 171-173 mayinclude a current that flows through a backside metal layer structure171-173 in response to the supply or other known voltage that is (orwas) applied to one or more of backside metal layer structures 171-173using TSV 161. This current may be based at least in part on theresistance (i.e., electrical characteristic) of the one or more backsidemetal layer structures 171-173.

PUF 120 and backside metal layer structures 171-173 are also configuredto, based at least in part on the electrical characteristics of thebackside metal layer structures 171-173, output a first fingerprintvalue when backside metal layer structures 171-173 have not beenmodified. PUF 120 and backside metal layer structures 171-173 are alsoconfigured to, based at least in part on the electrical characteristicsof the backside metal layer structures 171-173, output a secondfingerprint value, different from the first fingerprint value, when abackside metal layer structure 171-173 have been modified.

In an embodiment, PUF 120 may be further configured such that the firstfingerprint value is also based on an electrical characteristic of afront side metal layer (e.g., one of more of front side metal layerstructures 151-154.) Thus, PUF 120 may, based on the electricalcharacteristic of the front side metal layer structures 151-154, outputa third fingerprint value that is different from the first fingerprintvalue when a front side metal layer structure 151-154 has been modified.

In an embodiment, one or more of front side metal layer structures151-154 and/or backside metal layer structures 171-173 may comprise ananti-tamper mesh. For example, backside metal layer structures 171-173may be designed and laid out as a mesh of metal lines that arerelatively difficult to modify without causing a conductive path to form(or be destroyed) between parts of the mesh. This mesh may also bedesigned and laid out so that even relatively small modifications to themesh cause one or more electrical characteristics (e.g., resistance,capacitance, etc.) of the mesh to be changed enough to cause the valueoutput by PUF 120 to change.

FIG. 2A is an illustration of an integrated circuit having securitystructures and circuitry. In FIGS. 2A-2D, integrated circuit die 200includes a physically unclonable function circuitry (PUF) 220,unmodified fingerprint value 221, optional cryptographic circuitry 225,substrate 231, passivation layer 240, passivation layer 241, backsidemetal layer structure 271, backside metal layer structure 272, backsidemetal layer structure 273, front side metal layer structure 251, frontside metal layer structure 252, front side metal layer structure 253,front side metal layer structure 254, through-silicon via (TSV) 261, andTSV 262. PUF circuitry 220 and cryptographic circuitry 225 areillustrated as being integrated with substrate 231. Unmodifiedfingerprint value 221 is illustrated as coming from PUF 220 and beingprovided to cryptographic circuitry 225. Front side metal layerstructure 251 and front side metal layer structure 252 comprise metalthat is deposited closest (relative to other routing metal layers) tosubstrate 231 (a.k.a., metal 1 layer.) Front side metal layer structure253 and front side metal layer structure 254 comprise metal that isdeposited on one or more layers that are farther (relative to the firstmetal layer—metal 1) from substrate 231 (a.k.a., metal 2, metal 3, etc.layers.)

TSV 261 is, in some embodiments, connected to PUF circuitry 220 viafront side metal layer structure 251. TSV 262 is connected to PUFcircuitry 220 via front side metal layer structure 252. In someembodiments, PUF circuitry 220 is also connected to front side metallayer structure 254. Passivation layer 240, passivation layer 241, andfront side metal structures 251-254 are illustrated on the side ofintegrated circuit die 200 that includes PUF circuitry 220 (a.k.a. the‘front’ or ‘top’ side of integrated circuit die 200.) Backside metallayer structure 271, backside metal layer structure 272, and backsidemetal layer structure 273 are illustrated on the side of integratedcircuit die 200 that does not include active circuitry (a.k.a. the‘back’ or ‘bottom’ side of integrated circuit die 200.)

In an embodiment, one or more of TSV's 261-262 are used to establishconnectivity between PUF circuitry 220 and backside metal layerstructures 271-273. The backside metal layer structures 271-273 that areconnected to PUF 120 are thereby integrated as part of active PUFcircuitry 220. Thus, a modification to any one of backside metal layerstructures 271-273 that are connected to PUF 220 (e.g., during a FIBattack) would change the fingerprint value output by PUF 220 to one thatis different from unmodified fingerprint value 221. If unmodifiedfingerprint value 221 is used by cryptographic circuitry 225, toscramble, encrypt, or derive a value used to scramble or encrypt datastored on the chip (e.g., data stored in an on-chip non-volatilememory), changing the fingerprint value output by PUF 220 to one that isdifferent from unmodified fingerprint value 221 destroys the usabilityof the encrypted data stored on the chip.

PUF 220 relies on different naturally-mismatched physical properties ofintegrated circuits (and backside metal layer structures 271-273, inparticular) to produce unmodified fingerprint value 221. Backside metallayer structures 271-273 are connected to PUF 220 so that thenaturally-mismatched physical properties of backside metal layerstructures 271-273 affect the value output by PUF 220. For example, PUF220 may rely (at least in part) on the slight mismatch of resistancesformed by two or more backside metal layer structures 271-273 togenerate unmodified fingerprint value 221. These small (or large)variations in resistance across or between backside metal layerstructures 271-273 are used by PUF 220 to determine unmodifiedfingerprint value 221. Thus, when these small (or large) variations inresistance across or between backside metal layer structures 271-273 arechanged by, for example, a modification to a backside metal layerstructure 271-273, the fingerprint value output by PUF is changed 220 toone that is different from unmodified fingerprint value 221.

By using backside metal layer structures 271-273 (when appropriatelydesigned and laid out), as part of PUF 220, integrated circuit 200 ismade more resistant to several types of attacks. These include, but arenot limited to photonic emission attacks and FIB attacks. Photonicemission attacks are resisted because the backside metal layerstructures 271-273 absorb the near-infrared signals that are typicallycollected during this attack. Thus, removing all or part of a backsidemetal layer structure 271-273 so that the emissions of a sensitiveactive circuit on the front side can be observed causes the fingerprintvalue output by PUF 220 to change to a value that is different fromunmodified fingerprint value 221. This change in the fingerprint valueoutput by PUF 220 can be used to detect this tampering and/or renderprotected data on integrated circuit 200 unusable/unrecoverable. Inparticular, when the changed fingerprint value output by PUF 220 isinput (e.g., as a key or key seed) to cryptographic circuitry 225,unmodified fingerprint value 221 is lost and therefore not available todecrypt information that was encrypted with unmodified fingerprint value221. Likewise, a FIB attack that modifies a backside metal layerstructure 271-273, causes the fingerprint value output by PUF 220 tochange to a value that is different from unmodified fingerprint value221.

In an embodiment, PUF 220 is configured to apply a first electricalstimulus to backside metal layer structures 271-273. This electricalstimulus is applied through TSV 262. For example, PUF 220 may beconfigured to apply a supply or other known voltage to backside metallayer structures 271-273 using TSV 262. PUF 220 is also configured toreceive a response by backside metal layer structures 271-273 to thiselectrical stimulus. This response is based at least in part on anelectrical characteristic of backside metal layer structures 271-273.This response may be received using TSV 261.

Based at least in part on the electrical characteristics of the backsidemetal layer structures 271-273, PUF 220 outputs unmodified fingerprintvalue 221 when backside metal layer structures 271-273 have not beenmodified. Based at least in part on the electrical characteristics ofthe backside metal layer structures 271-273, PUF 220 outputs afingerprint value that is different from the unmodified fingerprintvalue 221 when a backside metal layer structure 271-273 has beenmodified.

In an embodiment, PUF 220 may be connected to one or more front sidemetal structures 251-254 such that unmodified fingerprint value 221 isalso based on the electrical characteristics of a front side metal layerstructure 251-254. Thus, when a front side metal layer structure 251-252has been modified, PUF 220 outputs a fingerprint value that is differentfrom unmodified fingerprint value 221. This new fingerprint value isbased on the electrical characteristics of at least one front side metallayer structures 251-254

In an embodiment, one or more of front side metal layer structures251-254 and/or backside metal layer structures 271-273 may comprise ananti-tamper mesh. For example, backside metal layer structures 271-273may be designed and laid out as a mesh of metal lines that arerelatively difficult to modify without causing a conductive path to form(or be destroyed) between parts of the mesh. This mesh may also bedesigned and laid out so that even relatively small modifications to themesh cause one or more electrical characteristics (e.g., resistance,capacitance, etc.) of the mesh to be changed enough to cause theunmodified fingerprint value 221 output by PUF 220 to change to adifferent value.

FIG. 2B is an illustration of the integrated circuit where a backsidesecurity structure has been modified by removing material. In FIG. 2B,part of backside metal structure 273 (shown in FIG. 2A) is illustratedas having been opened (i.e., modified—e.g., by a FIB machine) so that(at least for the cross-section shown in FIG. 2B) two separate backsidemetal structures 273 a and 273 b are separated by an opening 275.Opening 275 may have been made in order to observe or access circuitryvia the backside of integrated circuit 200. In an embodiment, thecreation of opening 275 changes the electrical characteristics of thebackside metal structure 273 shown in FIG. 2A (e.g., opening 275 changesthe resistance, capacitance, connections with, and/or inductance ofbackside metal structure 273) such that PUF 220 now outputs a modifiedfingerprint value 222 that is different from unmodified fingerprintvalue 221.

FIG. 2C is an illustration of the integrated circuit where a backsidesecurity structure has been modified by adding material. In FIG. 2C,backside metal structure 273 is illustrated as having been connected tobackside metal structure 272 by added material and/or metal 276. Metal276 may have deposited in order to electrically observe, circumvent,and/or access circuitry via the backside of integrated circuit 200. Inan embodiment, the addition of metal 276 changes the electricalcharacteristics of at least one of backside metal structure 272 and 272(e.g., metal 276 changes the resistance, capacitance, connections with,and/or inductance of at least one of backside metal structures 272 and273) such that PUF 220 now outputs a modified fingerprint value 223 thatis different from unmodified fingerprint value 221.

FIG. 2D is an illustration of the integrated circuit where a front sidesecurity structure has been modified by adding material. In FIG. 2D,front side metal structure 251 is illustrated as having been connectedto front side metal structure 252 by added material and/or metal 247.Metal 247 may have been deposited in order to electrically observe,circumvent, and/or access circuitry on the front side and/or backside ofintegrated circuit 200. In an embodiment, the addition of metal 247changes the electrical characteristics of at least one of front sidemetal structure 251 and 252 (e.g., metal 247 changes the resistance,capacitance, connections with, and/or inductance of at least one offront side metal structures 251 and 252) such that PUF 220 now outputs amodified fingerprint value 224 that is different from unmodifiedfingerprint value 221.

FIG. 3 is a flowchart illustrating a method of detecting modificationsto a backside metal layer. The steps in FIG. 3 may be performed by oneor more elements of integrated circuit 100 and/or integrated circuit200. By way of a first through-silicon via, an electrical stimulus isapplied to a backside metal layer (302). For example, PUF 220 may applya voltage and/or current to one or more of backside metal structures271-273 by way of TSV 262.

By way of a second through-silicon via, a response to the electricalstimulus that is based at least in part on an electrical characteristicof the backside metal layer is received (304). For example, PUF 220 mayreceive a response to the applied stimulus by way of TSV 261. Thisresponse may be based on an electrical characteristic (e.g., one or moreof resistance, capacitance, connectivity of, and/or inductance of, atleast one of backside metal structures 271-273). This response may be,for example, a voltage or a current.

A physically unclonable function (PUF) outputs, based at least in parton the electrical characteristic of the backside metal layer, a firstfingerprint value when the backside metal layer has not been modified,where the PUF is to output, based at least in part of the electricalcharacteristic of the backside metal layer, a second fingerprint valuethat is not equal to the first fingerprint value if the backside metallayer has been modified (306). For example, PUF 220 may, based on anelectrical characteristic of one or more of backside metal structures271-273, output unmodified fingerprint value 221 when none of backsidemetal structures 271-273 have been modified. PUF 220 may also beconfigured to, based on an electrical characteristic of one or more ofbackside metal structures 271-273, output a modified fingerprint value222-223 when at least one of backside metal structures 271-273 have beenmodified.

The methods, systems and devices described above may be implemented incomputer systems, or stored by computer systems. The methods describedabove may also be stored on a non-transitory computer readable medium.Devices, circuits, and systems described herein may be implemented usingcomputer-aided design tools available in the art, and embodied bycomputer-readable files containing software descriptions of suchcircuits. This includes, but is not limited to one or more elements ofintegrated circuit 100, integrated circuit 200, backside metalstructures 171-173, backside metal structure 271-273, TSVs 161-162, TSVs261-262, and their components. These software descriptions may be:behavioral, register transfer, logic component, transistor, and layoutgeometry-level descriptions. Moreover, the software descriptions may bestored on storage media or communicated by carrier waves.

Data formats in which such descriptions may be implemented include, butare not limited to: formats supporting behavioral languages like C,formats supporting register transfer level (RTL) languages like Verilogand VHDL, formats supporting geometry description languages (such asGDSII, GDSIII, GDSIV, CIF, and MEBES), and other suitable formats andlanguages. Moreover, data transfers of such files on machine-readablemedia may be done electronically over the diverse media on the Internetor, for example, via email. Note that physical files may be implementedon machine-readable media such as: 4 mm magnetic tape, 8 mm magnetictape, 3½ inch floppy media, CDs, DVDs, and so on.

FIG. 4 is a block diagram illustrating one embodiment of a processingsystem 400 for including, processing, or generating, a representation ofa circuit component 420. Processing system 400 includes one or moreprocessors 402, a memory 404, and one or more communications devices406. Processors 402, memory 404, and communications devices 406communicate using any suitable type, number, and/or configuration ofwired and/or wireless connections 408.

Processors 402 execute instructions of one or more processes 412 storedin a memory 404 to process and/or generate circuit component 420responsive to user inputs 414 and parameters 416. Processes 412 may beany suitable electronic design automation (EDA) tool or portion thereofused to design, simulate, analyze, and/or verify electronic circuitryand/or generate photomasks for electronic circuitry. Representation 420includes data that describes all or portions of integrated circuit 100,integrated circuit 200, and their components, as shown in the Figures.

Representation 420 may include one or more of behavioral, registertransfer, logic component, transistor, and layout geometry-leveldescriptions. Moreover, representation 420 may be stored on storagemedia or communicated by carrier waves.

Data formats in which representation 420 may be implemented include, butare not limited to: formats supporting behavioral languages like C,formats supporting register transfer level (RTL) languages like Verilogand VHDL, formats supporting geometry description languages (such asGDSII, GDSIII, GDSIV, CIF, and MEBES), and other suitable formats andlanguages. Moreover, data transfers of such files on machine-readablemedia may be done electronically over the diverse media on the Internetor, for example, via email

User inputs 414 may comprise input parameters from a keyboard, mouse,voice recognition interface, microphone and speakers, graphical display,touch screen, or other type of user interface device. This userinterface may be distributed among multiple interface devices.Parameters 416 may include specifications and/or characteristics thatare input to help define representation 420. For example, parameters 416may include information that defines device types (e.g., NFET, PFET,etc.), topology (e.g., block diagrams, circuit descriptions, schematics,etc.), and/or device descriptions (e.g., device properties, devicedimensions, power supply voltages, simulation temperatures, simulationmodels, etc.).

Memory 404 includes any suitable type, number, and/or configuration ofnon-transitory computer-readable storage media that stores processes412, user inputs 414, parameters 416, and circuit component 420.

Communications devices 406 include any suitable type, number, and/orconfiguration of wired and/or wireless devices that transmit informationfrom processing system 400 to another processing or storage system (notshown) and/or receive information from another processing or storagesystem (not shown). For example, communications devices 406 may transmitcircuit component 420 to another system. Communications devices 406 mayreceive processes 412, user inputs 414, parameters 416, and/or circuitcomponent 420 and cause processes 412, user inputs 414, parameters 416,and/or circuit component 420 to be stored in memory 404.

The foregoing description of the invention has been presented forpurposes of illustration and description. It is not intended to beexhaustive or to limit the invention to the precise form disclosed, andother modifications and variations may be possible in light of the aboveteachings. The embodiment was chosen and described in order to bestexplain the principles of the invention and its practical application tothereby enable others skilled in the art to best utilize the inventionin various embodiments and various modifications as are suited to theparticular use contemplated. It is intended that the appended claims beconstrued to include other alternative embodiments of the inventionexcept insofar as limited by the prior art.

What is claimed is:
 1. An integrated circuit, comprising: an activecircuitry side metal layer; a backside metal layer; and, a physicallyunclonable function circuit connected to the active circuitry side metallayer and to the backside side metal layer to output a first fingerprintvalue, a modification of an electrical characteristic of the backsidemetal layer to cause the physically unclonable function circuit tooutput a second fingerprint value that is not equal to the firstfingerprint value.
 2. The integrated circuit of claim 1, wherein thebackside metal layer is connected to the physically unclonable functioncircuit using at least one through-silicon via.
 3. The integratedcircuit of claim 2, wherein a modification of an electricalcharacteristic of the active circuitry side metal layer is to cause thephysically unclonable function circuit to output a third fingerprintvalue that is not equal to the first fingerprint value
 4. The integratedcircuit of claim 2, wherein the integrated circuit is configured toderive a key for a cryptographic function of the integrated circuit atleast in part on the first fingerprint value.
 5. The integrated circuitof claim 2, wherein the active circuitry side metal layer comprises afirst mesh comprising a plurality of active circuitry side metal lines.6. The integrated circuit of claim 5, wherein the backside metal layercomprises a second mesh comprising a plurality of backside metal lines.7. The integrated circuit of claim 1, wherein the first fingerprintvalue is dependent on an electrical characteristic of at least onethrough-silicon via.
 8. A method of operating an integrated circuit,comprising: applying, by way of a first at least one through-siliconvia, an electrical stimulus to a backside metal layer; receiving, by wayof a second at least one through silicon via, a response to theelectrical stimulus that is based at least in part on an electricalcharacteristic of the backside metal layer; and, evaluating a physicallyunclonable function (PUF) that outputs, based at least in part on theelectrical characteristic of the backside metal layer, a firstfingerprint value when the backside metal layer has not been modified,the PUF configured to output, based at least in part on the electricalcharacteristic of the backside metal layer, a second fingerprint valuethat is not equal to the first fingerprint value if the backside metallayer has been modified.
 9. The method of claim 8, wherein the firstfingerprint value is further based on an electrical characteristic of anactive circuitry side metal layer.
 10. The method of claim 9, whereinthe PUF is further configured to output, based at least in part on theelectrical characteristic of the active circuitry side metal layer, athird fingerprint value that is not equal to the first fingerprint valueif the active circuitry side metal layer has been modified.
 11. Themethod of claim 8, further comprising: basing a key for a cryptographicfunction of the integrated circuit on the first fingerprint value. 12.The method of claim 8, wherein the backside metal layer comprises afirst mesh comprising a plurality of backside metal lines.
 13. Themethod of claim 12, wherein the PUF is further configured to output,based at least in part on the electrical characteristic of the activecircuitry side metal layer, a third fingerprint value that is not equalto the first fingerprint value if the active circuitry side metal layerhas been modified.
 14. The method of claim 13, wherein the activecircuitry side metal layer comprises a second mesh comprising aplurality of active circuitry side metal lines.
 15. An integratedcircuit, comprising: a first anti-tamper metal structure on the backside of a planar integrated circuit substrate; and, at least onethrough-silicon via connecting the first anti-tamper metal structure toactive circuitry on an active circuitry side of a planar integratedcircuit substrate, the active circuitry comprising a physicallyunclonable function circuit configured to output a first fingerprintvalue based at least in part on the first anti-tamper metal structurebeing unmodified and to output a second fingerprint value based at leastin part on a modification of the first anti-tamper metal structure thatchanges an electrical characteristic of the first anti-tamper metalstructure.
 16. The integrated circuit of claim 15, further comprising: asecond anti-tamper metal structure on the active circuitry side.
 17. Theintegrated circuit of claim 16, wherein the physically unclonablefunction circuit is further configured to output the first fingerprintvalue based at least in part on the second anti-tamper metal structurebeing unmodified and to output a third fingerprint value based at leastin part on a modification of the second anti-tamper metal structure thatchanges an electrical characteristic of the second anti-tamper metalstructure.
 18. The integrated circuit of claim 17, wherein theintegrated circuit is configured to base a key for a cryptographicfunction of the integrated circuit at least in part on the firstfingerprint value.
 19. The integrated circuit of claim 18, wherein thefirst anti-tamper metal structure comprises a first mesh comprising afirst plurality of metal lines.
 20. The integrated circuit of claim 19,wherein the second anti-tamper metal structure comprises a second meshcomprising a second plurality of metal lines.